CmdID / PowerShell / Cmdlets / Get
Get-ItemPropertyValue
Gets the value for one or more properties of a specified item. PowerShell reference
From the PowerShell reference
8 parameters
Alias gpv
1 Sigma rule looks for it
What it does
Gets the value for one or more properties of a specified item. The Get-ItemPropertyValue gets the current value for a property that you specify when you use the Name parameter, located in a path that you specify with either the Path or LiteralPath parameters.
Get-ItemPropertyValue [[-Path] <String[]>] [-Name] <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-UseTransaction] [<CommonParameters>]Get-ItemPropertyValue -LiteralPath <String[]> [-Name] <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-UseTransaction] [<CommonParameters>]Get the value of the ProductID property
Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductIDIdentifyTrips 1 Sigma rule: lowSystem Information Discovery via Registry Queries by lazarg
Get the last write time of a file or folder
Get-ItemPropertyValue -Path 'C:\Program Files\WindowsPowerShell' -Name LastWriteTimeIdentifyGet multiple property values of a file or folder
Get-ItemPropertyValue -Path 'C:\Program Files\WindowsPowerShell' -Name LastWriteTime,CreationTime,RootIdentifyIts page in the reference: Get-ItemPropertyValue.
Parameters
-CredentialSpecifies a user account that has permission to perform this action. The default is the current user.
WARNING: This parameter is not supported by any providers installed with Windows PowerShell.-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes from the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted.-FilterSpecifies a filter in the format or language of the provider. The value of this parameter qualifies the Path parameter.
The syntax of the filter, including the use of wildcard characters, depends on the provider. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted.-LiteralPathSpecifies the path to the current location of the property. Unlike the Path parameter, the value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.-NameSpecifies the name of the property or properties to retrieve.-PathSpecifies the path to the item or items.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.